AU/ACSC/0 19/200 1-04 


AIR  COMMAND  AND  STAFF  COLLEGE 

AIR  UNIVERSITY 

INFORMATION  WAR  CRIMES: 
MITNICK  MEETS  MIEOSEVIC 


by 

Darwyn  O.  Banks,  Major,  USAE 

A  Research  Report  Submitted  to  the  Eaculty 
In  Partial  Eulfillment  of  the  Graduation  Requirements 

Advisor:  Et  Col  Steven  R.  Hansen 

Maxwell  Air  Eorce  Base,  Alabama 
April  2001 


Distribution  A:  Approved  for  public  release;  distribution  is  unlimited 


Report  Documentation  Page 


Report  Date 

Report  Type 

Dates  Covered  (from...  to) 

01APR2001 

N/A 

- 

Title  and  Subtitle 

Information  War  Crimes:  Mitnick  Meets  Milosevic 


Author(s) 

Banks,  Darwyn  O. 


Performing  Organization  Name(s)  and  Address(es) 

Air  Command  and  Staff  College  Air  University  Maxwell 
AFB,  AL 

Sponsoring/Monitoring  Agency  Name(s)  and 
Address(es) 

Distribution/Availability  Statement 

Approved  for  public  release,  distribution  unlimited 

Supplementary  Notes 

The  original  document  contains  color  images. 

Abstract 


Subject  Terms 


Report  Classification 

unclassified 

Classification  of  this  page 

unclassified 

Classification  of  Abstract 

unclassified 

Limitation  of  Abstract 

UU 

Number  of  Pages 

40 


Contract  Number 
Grant  Number 
Program  Element  Number 
Project  Number 
Task  Number 
Work  Unit  Number 

Performing  Organization  Report  Number 

Sponsor/Monitor’s  Acronym(s) 
Sponsor/Monitor’s  Report  Number(s) 


Disclaimer 


The  views  expressed  in  this  aeademie  researeh  paper  are  those  of  the  author  and  do 
not  reflect  the  official  policy  or  position  of  the  US  government  or  the  Department  of 
Defense.  In  accordance  with  Air  Force  Instruction  51-303,  it  is  not  copyrighted,  but  is  the 
property  of  the  United  States  Government. 


Contents 


Page 

DISCLAIMER . ii 

ILLUSTRATIONS . iv 

TABLES . V 

ACKNOWEEDGMENTS . vi 

ABSTRACT . vii 

INTRODUCTION . I 

Mitnick . 2 

Milosevic . 4 

THE  LAW  OE  ARMED  CONFLICT . 7 

INFORMATION  OPERATIONS  AND  INFORMATION  WARFARE . 14 

THE  LAW  OF  ARMED  CONFLICT  MEETS  INFORMATION  WARFARE . 21 

Mitnick  meets  Milosevic . 27 

Conclusion . 28 

BIBLIOGRAPHY . 31 


iii 


Illustrations 


Figure  1 :  Information  Operation:  Capabilities  and  Related  Aetivities 


Page 
. 15 


Tables 


Table  1  Examples  of  Potential  Information  Warfare  Attacks 


Page 
. 16 


V 


Acknowledgments 


I  would  be  remiss  if  I  didn't  acknowledge  the  invaluable  assistance  provided  by  my 
advisor,  Lt  Col  Steve  Hansen,  by  Dr  Abby  Gray-Briggs  and  by  the  phenomenal  staff  at 
AU  Library,  especially  Ms.  Diana  Simpson.  I  must  also  thank  my  sponsors,  Lt  Col 
Richard  Aldrich  and  Lt  Col  Charles  Williamson,  the  judge  advocates  at  Headquarters,  Air 
Force  Office  of  Special  Investigations  and  at  the  Joint  Task  Force-Computer  Network 
Defense,  respectively,  for  their  assistance  and  encouragement  of  this  layman  on  legal 
turf 


VI 


AU/ACSC/0 19/200 1-04 


Abstract 

In  this  paper  the  author  examines  areas  of  overlap  between  information  erimes  (also 
known  as  haeking  and  eyberterrorism)  and  traditional  war  erimes  as  defined  by  the 
internationally  aeeepted  laws  of  armed  eonfliet  paying  speeial  attention  to  the  prineiples 
of  chivalry,  humanity,  proportionality,  and  military  necessity.  The  paper  further  explores 
the  potential  culpability  of  information  warfare  practitioners  should  this  intersection  of 
information  warfare  and  war  crimes  become  codified  into  international  law. 
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Chapter  1 


Introduction 

The  cyberwar  revolution,  however,  poses  serious  problems  for  the  U.S.  Some  are 
ethical:  Is  it  a  war  crime  to  crash  another  country's  stock  market? 

—TIME,  August  1995' 

The  law  of  armed  conflict  is  an  internationally  accepted  standard  which  defines  the  conduct 
of  war  between  ‘civilized  nations.’  It  has  served  the  world  well  since  its  earliest  inception  in  the 
17*  century.^  As  the  state-of-the-art  and  the  state-of-the-practice  have  advanced,  the  global 
community  has  seen  fit  to  revise  and  update  this  body  of  law  many  times  to  ensure  its  continued 
applicability  and/or  to  address  the  conundrums  posed  by  the  new  technologies. 

The  Information  Age  dawned  just  as  the  20*  century  began  drawing  to  a  close.  With  the 
new  age  came  new  civil  crimes,  e.g.,  hacking,  cyberterrorism,  which  forced  law  enforcement 
communities  around  the  globe  to  adapt — some  better  than  others.  One  key  question  which 
remains  largely  unanswered,  however,  concerns  the  application  of  international  law  in  the 
Information  Age.  Specifically,  how  might  emerging  interpretations  of  the  law  of  armed  conflict 
re-define  war  crimes  in  the  realm  of  information  warfare? 

Building  on  examples  of  information  crimes  and  of  war  crimes  from  recent  events,  this 
paper  focuses  on  the  four  defining  principles  from  law  of  armed  conflict  as  they  apply  to 
traditional  war  crimes:  chivalry,  humanity,  proportionality,  and  military  necessity  and  explores 
ways  in  which  these  may  apply  to  war  in  the  Information  Age. 
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Mitnick 


/  have  gained  unauthorized  access  to  computer  systems  at  some  of  the  largest 
corporations  on  the  planet,  and  have  successfully  penetrated  some  of  the  most 
resilient  computer  systems  ever  developed. 

— ^Kevin  Mitnick^ 

In  February  1995  law  enforcement  agents  from  the  Federal  Bureau  of  Investigation  finally 
tracked  down  and  arrested  wanted  cyber-criminal,  Kevin  D.  Mitnick,  in  North  Carolina."^  The 
California-based  fugitive  led  authorities  on  a  cross-country  chase  for  more  than  two  years  while 
fleeing  from  charges  he  gained  unauthorized  access  to  the  computer  systems  of  the  California 
Department  of  Motor  Vehicles  in  1992.  Immediate  accusations  against  him  included  stealing 
thousands  of  data  files  and  more  than  20,000  credit  card  numbers  from  computer  systems  at 
Motorola,  Nokia  Mobile  Phones,  Fujitsu,  Novell,  NEC,  Sun  Microsystems,  Colorado  SuperNet 
and  the  University  of  Southern  California,  to  name  a  few,  with  estimated  damages  approaching 
$80  million.^ 

Fact  and  fiction  converge  on  the  subject  of  Mitnick.  Some  accounts  credit  Mitnick  with 
successfully  hacking  into  the  systems  of  the  North  American  Aerospace  Defense  Command 
(NORAD)  in  the  early  1980s  and  thus  becoming  the  inspiration  for  the  1983  motion  picture.  War 
Games.^  Additional  allegations  have  him  gaining  temporary  control  of  central  telephone  offices 
in  New  York  City  and  phone  switching  centers  in  California,  as  well  as  stealing  between  $1 
million  and  $4  million  in  proprietary  software  from  computers  at  Digital  Equipment 
Corporation.’  Truth  or  fantasy,  the  police  record  on  Mitnick  does  include  exploits  going  back 
more  than  a  decade  to  1981  when  juvenile  courts  sentenced  the  teenaged  Mitnick  to  probation 

o 

for  electronic  theft  of  computer  documents  from  his  local  telephone  company.  Ultimately, 
Mitnick  received  indictments  on  25  counts  of  wire  fraud,  computer  fraud,  possessing  unlawful 
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access  devices,  damaging  computers,  theft  of  software  valued  in  the  millions  of  dollars,  using 
stolen  computer  passwords  and  intereepting  electronic  messages.^  After  plea  bargaining,  Mitniek 
served  a  total  of  five  years  behind  bars  with  more  than  a  few  months  in  solitary  eonfinement 
beeause  the  judge  feared  he  eould  access  computers  via  the  telephone  and  “launch  nuclear 
missiles  by  whistling  into  the  phone. 

None  of  Mitniek’ s  exploits,  however,  violated  international  law.  Despite  the  borderless 
potential  of  his  actions,  the  known  effects  of  Mitnick’s  documented  crimes  remained  within  the 
United  States.  Onel  de  Guzman,  on  the  other  hand,  is  another  computer  criminal  whose  effects 
did  cross  borders.  In  May  of  2000,  de  Guzman,  a  failed  Filipino  collegian  from  AMA  Computer 
College,  released  the  “ILOVEYOU”  eomputer  virus  whieh  had  been  written  in  an  effort  to  gain 
free  access  to  the  Internet  by  stealing  passwords  to  loeal  service  providers.'^  The  virus  quiekly 
infected  computers  worldwide,  ineluding  many  in  the  U.S.  Department  of  Defense  as  well  as  the 
British  House  of  Commons.  It  overloaded  e-mail  systems  and  by  some  estimates  caused 
approximately  $10  billion  worth  of  damage.  Still,  despite  the  doeumented  international  effects 
of  the  so-called  “Love  Bug”  virus,  de  Guzman  reeeived  more  reward  than  punishment.  At  the 
time  of  the  virus’  release.  The  Philippines  had  no  statutes  on  the  books  forbidding  computer 
misuse  and  that  eountry's  National  Bureau  of  Investigation  had  insufficient  evidence  to  convict 
de  Guzman  of  the  closest  “traditional”  cognates:  theft  and  credit  eard  fraud.  Ultimately,  the 
government  in  Manila  dropped  all  domestic  charges  filed  against  him  while  the  man  himself 
received  offers  of  lucrative  employment  from  international  computer  firms,  his  lack  of  a  degree 
notwithstanding. 

Unfortunately,  The  Philippines  are  not  alone.  Neither  are  the  industrialized  nations,  sueh  as 
members  of  the  G-7,  standing  above  the  fray.  At  present,  dissemination  of  eomputer  viruses  is 
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not  illegal  in  Japan. Until  a  highly  publicized  series  of  hacking  attacks  in  February  2000,  the 
Land  of  the  Rising  Sun  was  the  only  major  industrialized  nation  that  did  not  prohibit  illegal  entry 
to  computer  networks,  i.e.,  hacking.  At  the  time  of  the  attacks,  the  headlines  of  Mainichi 
Shimbun,  a  nationwide  Japanese  newspaper,  boldly  proclaimed:  “Welcome,  Japan,  to  the  world 
of  cyberwar.”  But  was  that  really  accurate?  The  messages  may  have  claimed  foreign  origins, 
but  computer  crimes,  in  and  of  themselves,  are  not  warfare. 

Milosevic 

I've  always  considered  the  international  tribunal  at  The  Hague  an  illegal  and 
immoral  institution. 

— Slobodan  Milosevic^^ 

While  Messrs.  Mitnick  and  de  Guzman  may  have  steered  clear  of  international  law,  one 
criminal  who  plainly  did  not  is  the  former  Yugoslavian  president,  Slobodan  Milosevic.  He  stands 
apart  from  either  of  the  two  aforementioned  individuals  in  that,  as  of  this  writing  in  February 
2001,  he  has  yet  to  come  before  any  tribunal — domestic  or  international.  The  charges  against 
him  include  crimes  against  humanity  and  violations  of  the  customs  of  war.  Where  Mitnick  and 

de  Guzman  committed  information  crimes,  Milosevic  stands  accused  of  traditional  war  crimes — 

2 1 

specifically  murder,  deportation  and  persecution. 

With  indictments  handed  down  by  an  internationally  chartered  judicial  body,  the 
International  Criminal  Tribunal  for  the  Former  Yugoslavia  (ICTY),  Milosevic’s  crimes  clearly 
reside  in  the  domain  of  international  law.  The  United  Nations  Security  Council  established  that 
international  tribunal  in  February  1993  based  upon  its  investigations  of  Balkan  fighting  which 
found  “  ‘grave  breaches’  of  international  norms,”  such  as  mass  killings,  torture,  systematic  rape, 
complete  destruction  of  civilian  towns  and  housing,  and  violent  dislocation  of  the  populace — i.e.. 
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ethnic  cleansing.  While  there  are  no  claims  that  Milosevic  personally  committed  any  such 
crimes,  he  is  culpable  under  the  principles  of  command  responsibility  and  direct  responsibility. 
The  former  alleges  Milosevic’s  foreknowledge  of  such  crimes  without  acting  either  to  prevent 
the  commission  thereof  or  to  punish  the  perpetrators.  The  latter  form  of  responsibility  implies  he 
authorized,  planned,  instigated  and/or  ordered  the  unlawful  acts.  These  indictments  against  the 
former  Yugoslav  president,  then,  highlight  the  primary  categories  of  the  law  of  armed  conflict. 
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Chapter  2 


The  Law  of  Armed  Conflict 

The  right  of  belligerents  to  adopt  means  of  injuring  the  enemy  is  not  unlimited. 

— ^Protocol  IV  of  the  Hague  Convention^ 

Two  primary  sets  of  treaties  eomprise  the  law  of  armed  eonfliet.  The  Hague  Convention 
foeuses  on  the  means  and  methods  of  warfare.  This  law  addresses  the  violations  of  the  eustoms 
of  war  and  diseusses  how  “eivilized  warring  states”  should  proseeute  war.  Its  eounterpart,  the 
Geneva  Convention,  deals  more  speeifieally  with  the  status  of  non-belligerents  and  other 
proteeted  persons,  e.g.,  prisoners  of  war,  wounded  belligerents,  ehaplains,  medieal  personnel, 
and  eivilians.  The  treaties  of  the  Geneva  Convention  seek  to  ameliorate  the  effeets  of  war  on 
both  soldiers  and  eivilians. 

Additionally,  there  are  more  speeifie  preeedents  set  forth  in  the  London  Charter  of  1945. 
The  Allies — Franee,  the  Union  of  Soviet  Soeialist  Republies,  the  United  Kingdom,  and  the 
United  States — used  this  eharter  to  establish  the  International  Military  Tribunals  at  Niimberg 
after  World  War  II  and  held  defendants  from  defeated  Nazi  Germany  individually  responsible 
for  notions  taken  during  the  war.  The  London  Charter  oodifies  categories  of  these  crimes  as 
follows:  crimes  against  peace,  war  crimes  and  crimes  against  humanity."^  Crimes  against  peace 
include  the  steps  leading  up  to  and  including  a  war  of  aggression,  i.e.,  planning,  preparing, 
initiating  and/or  waging  such  a  war.  The  war  crimes  category  encompasses  murder. 
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mistreatment — e.g.,  murder  or  torture — of  prisoners  of  war,  deportation  for  slave  labor,  killing 
hostages,  destruction  of  cities,  towns  or  villages  not  justified  by  military  necessity,  and  plunder. 
Crimes  against  humanity  duplicate  many  of  the  atrocities  from  the  ‘war  crimes’  category  but 
with  an  emphasis  on  civilian  victims — e.g.,  murder,  enslavement,  deportation,  rape  and  other 
inhumane  acts  against  civilian  populations  in  war.^ 

Beneath  the  overarching  conventions,  the  law  of  armed  conflict  breaks  down  into  a  series  of 
four  basic  principles.  These  are  chivalry,  humanity,  military  necessity  and  proportionality.^ 
Given  the  terminology,  the  first  principle,  chivalry,  might  seem  to  be  a  throwback  to  medieval 
times.  In  fact.  Encyclopedia  Britannica  defines  chivalry  as  the  “honourable  and  courteous 
conduct  expected  of  a  knight.”^  Realizing,  however,  that  the  knight  of  yore  is  the  soldier,  sailor, 
airman  or  Marine  of  today  aptly  underscores  the  meaning  of  this  principle  in  the  context  of  the 
law  of  armed  conflict. 

At  the  dawn  of  the  21®*  century,  chivalry  has  come  to  be  the  requirement  that  nations  wage 

Q 

war  in  accordance  with  internationally  recognized  courtesies  and  formalities.  The  most  practical 
modem  example  is  the  chivalric  prohibition  against  perfidy  defined  as  “acts  inviting  the 
confidence  of  an  adversary  to  lead  him  to  believe  he  is  entitled  to,  or  is  obliged  to,  accord 
protection  under  the  mles  of  international  law  applicable  in  armed  conflict  with  intent  to  betray 
that  confidence.”^  Perfidious  actions  include  combatants  falsely  donning  the  uniforms  of  the 
enemy  or  the  symbology  of  non-combatants,  e.g.,  chaplains,  medics  or  United  Nations 
peacekeepers.  Perfidy  can  also  include  faking  surrender,  cease-fire,  armistice  and/or 
incapacitation  both  to  draw  one’s  opponent  in  close  and  simultaneously  to  lull  him  into  a  false 
sense  of  security.***  Obviously,  the  systemic  danger  of  permitting  such  treachery  mns  parallel  to 
the  risk  incurred  by  the  proverbial  boy  who  cries  “Wolf!”  Continued  misuse  of  protected 
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symbols  could  quickly  lead  combatants  to  disregard  them  all,  thus  nullifying  their  special  status 
and  needlessly  prolonging  the  combat/^ 

The  second  principle  is  humanity.  This  principle  proscribes  eombatants  from  inflicting 
“unnecessary  suffering”  either  upon  other  combatants  or  upon  civilian  populations.  Under  the 
aegis  of  humanity,  the  international  eommunity  has  banned  a  variety  of  weapons  whieh  cause 
‘superfluous  injury’ — e.g.,  dum-dum  bullets  whieh  expand  on  contact  and/or  cause  espeeially 
painful  wounds,  poisoned  weapons,  laser  weaponry  speeifically  designed  to  cause  permanent 
blindness,  and  projeetiles  filled  with  glass  or  other  fragments  which  are  difficult  for  medics  to 
detectable  and  remove.  In  American  military  jurisprudence,  judge  advocates  review  eaeh  new 
or  proposed  weapons  system  before  deployment  to  the  field  specifieally  to  determine  the 
weapon’s  legality  in  aceordance  with  the  law  of  armed  conflict's  principle  of  humanity.  Also 
prohibited  under  this  principle  are  bacteriological,  biological  and  chemical  agents  which 
typically  have  indiscriminate  effects — i.e.,  they  affeet  wide  areas  and  eould  easily  spread  to 
impact  nearby  civilians. 

Military  necessity  is  the  third  principle.  It  permits  combatants  to  expend  only  as  mueh  force 
as  is  necessary  to  achieve  their  aims — typically,  the  opponents’  submission — ^with  minimal  cost 
in  terms  of  time,  resources  and  loss  of  life. In  this  sense  military  neeessity  precludes  the  type  of 
overkill  that  might  be  expected  between  mismatehed  belligerents  where  one’s  foree  greatly 
outnumbers  or  outclasses  the  other’s.  An  extreme  example  would  be  a  superpower’s  unlikely  and 
ill-advised  recourse  to  intercontinental  ballistie  missiles  when  arrayed  against  a  non-nuclear 
enemy  without  the  capability  or  the  wherewithal  similarly  to  threaten  the  superpower. 

Additionally,  military  neeessity  speeifically  exempts  civilian  objects  and  property  from 
being  deliberately  targeted  unless  the  destruction  or  incapacitation  thereof  would  produce  a 
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direct  military  advantage.  Of  course,  civilian  materiel  which  is  of  dual  use  would  be  a  legal 

target  inasmuch  as  its  “damage  or  destruction  would  produce  a  military  advantage  because  of 

their  nature,  location,  purpose,  or  use.”  Citing  Protocol  IV  of  the  1907  Hague  Convention:  “[it 

is  especially  forbidden]  to  destroy  or  seize  the  enemy’s  property,  unless  such  destruction  or 

1 8 

seizure  be  imperatively  demanded  by  the  necessities  of  war.” 

The  last  principle  is  proportionality.  Closely  related  to  the  principle  of  humanity, 

proportionality  requires  combatants  to  consider  the  potential  effect  of  their  bellicose  actions  upon 

the  civilian  population.  Note  that  proportionality  doesn’t  prohibit  all  targeting  that  could  impact 

the  populace;  in  war  collateral  damage  may  often  be  unavoidable.  Rather  this  principle  requires  a 

conscious  assessment  of  the  military  necessity  of  the  target  and  anticipated  military  advantage  of 

its  destruction  against  the  projected  civilian  losses,  both  tangible  and  intangible.  Thus,  assuming 

the  defender  is  not  attempting  to  hide  legitimate  military  targets  within  them,  civilian  institutions 

such  as  hospitals,  schools,  mosques,  churches  or  museums  rarely  provide  sufficient  military 
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advantage  as  targets  to  justify  the  cost  of  hitting  them. 

In  addition  to  the  four  foregoing  principles,  international  law  also  includes  concepts  of 
reprisal  and  retorsion.  While  these  two  are  not  strictly  part  of  the  law  of  armed  conflict,  they  do 
prescribe  the  methods  by  which  countries  may  appropriately  respond  to  belligerence  directed 
against  them.  Thus,  in  the  context  of  information  warfare  and  potential  commission  of 
information  war  crimes,  these  concepts  become  noteworthy  for  their  import  to  the  range  of 
available  responses. 

The  primary  distinction  between  the  concepts  of  retorsion  and  reprisal  is  legality.  While 
both  entail  unfriendly  acts,  the  former  is  an  unambiguously  legal  recourse  taken  for  retaliatory  or 
coercive  purposes.  The  use  of  force  for  the  latter  would  normally  be  illegal  outside  of  the  set  of 


10 


23 

prescriptive  steps  reprisal  delineates.  Examples  of  retorsion  might  include  such  actions  as 
cessation  of  economic  aid,  the  shutting  of  ports,  travel  restrictions,  denial  of  entry  visas, 
revocation  of  tariff  concessions,  or  display  of  naval  forces. These  are  unfriendly  measures  but 
not  prohibited  by  international  law. 

Reprisals,  on  the  other  hand,  do  involve  the  use  of  force  and  are  illegal  unless  the  following 
conditions  apply.  First,  the  reprisal  must  itself  be  a  response  to  the  illegal  action  of  another  state. 
Second,  the  victim  of  that  illegal  precursor  must  give  the  original  assailant  state  the  formal 
opportunity  to  redress  the  situation.  Finally,  if  the  victim  state  does  not  receive  satisfaction,  it 
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may  retaliate  pursuant  to  the  principle  of  proportionality. 

“A  State  victim  of  a  violation  of  an  international  obligation  by  another  state  may 
resort  to  countermeasures  that  might  otherwise  be  unlawful,  if  such  measures  (a) 
are  necessary  to  terminate  the  violation  or  prevent  further  violation,  or  to  remedy 
the  violation;  and  (b)  are  not  out  of  proportion  to  the  violation  and  the  injury 
suffered. 

The  four  principles  of  the  law  of  armed  conflict  define  the  boundaries  within  which  nations, 
their  leaders  and  their  combatants  must  operate  as  members  of  the  global  community.  Drawn 
from  the  successive  Hague  and  Geneva  Conventions,  these  principles  represent  the  cumulative 
efforts  over  the  centuries  of  states  and  statesmen  to  establish  better — some  might  say,  ‘more 
civilized’ — ways  of  handling  international  problems  and  of  resolving  international  disputes. 
Heretofore,  “war  was  not  subject  to  any  control  other  than  that  exercised  by  the  combatants 
themselves.  Any  limitations  those  combatants  might  have  placed  on  their  actions  on  the 
battlefield  would  have  been  due  only  to  military  necessity  rather  than  any  belief  that  to  attack 
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civilians  or  to  kill  prisoners  of  war  was  wrong — let  alone  illegal.” 

Beginning  with  Dutchman  Hugo  Grotius’  17*  century  treatise,  De  Jure  Belli  ac  Pacis^^ 
(1625),  that  conception  began  to  change.  Of  course,  technological  advances  certainly  continued 
unabated.  By  1899  The  Hague  Conventions  specifically  include  the  “Martens  Clause”  to  extend 
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established  custom  and  humanitarian  principles  to  new  technologies  which  would  arise  after  the 
close  of  the  19*  century.  Even  then,  the  means  of  warfare  were  ever-changing.  This  clause  was 
an  attempt  “to  prevent  future  unnecessary  and/or  disproportionate  destruction  from  weapon 
systems  not  yet  developed.”  Its  ancillary  effect  set  the  precedent — quite  pertinent  to  modern 
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discussions  of  information  warfare — ^which  judges  an  attack  by  its  effects,  not  its  methods. 

Even  with  the  Martens  Clause,  nations  still  have  seen  fit  periodically  to  revise  and  update 
international  law.  Eor  example,  with  the  advent  of  military  airpower,  the  same  1899  Convention 
in  The  Hague  also  accepted  a  declaration  prohibiting  the  discharge  of  projectiles  or  explosives 
from  balloons.  Eike  other  turn-of-the-20th-century  declarations  against  asphyxiating  gas  and 
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expanding  dum-dum  bullets,  this  proscription  failed  to  carry  over  to  powered  flight. 
Nonetheless,  its  consideration  set  the  precedent  for  the  world  community  to  re-assess  and  update 
its  agreements  as  required  and,  more  importantly,  underscored  the  protocol  that  “the  right  of 
belligerents  to  adopt  means  of  injuring  the  enemy  is  not  unlimited.”  Therefore,  the  matter  in 
question  is  how  might  the  comity  of  nations  eventually  limit  the  means  of  information  warfare? 
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Chapter  3 


Information  Operations  and  Information  Warfare 


Information  warfare  is  waged  against  industries,  political  spheres  of  influence, 
global  economic  forces,  or  even  against  entire  countries.  It  is  the  use  of 
technology  against  technology;  it  is  about  secrets  and  the  theft  of  secrets;  it  is 
about  turning  information  against  its  owners;  it  is  about  denying  an  enemy  the 
ability  to  use  both  his  technology  and  his  information. 

— ^Winn  Schwartau^ 

Joint  Publication  3-13,  Joint  Doctrine  for  Information  Operations,  defines  information 
warfare  as  the  subset  of  “information  operations  eondueted  during  time  of  erisis  or  eonflict  to 
achieve  or  promote  specific  objectives  over  a  specific  adversary  or  adversaries.”  Information 
operations,  then,  are  those  “actions  taken  to  affect  adversary  information  and  information 
systems  while  defending  one’s  own  information  and  information  systems.”^  The  superset  of 
information  operations  includes  a  variety  of  diseiplines:  operational  security,  psychological 
operations,  electronic  warfare,  military  deception,  command  and  control  warfare,  intelligence, 
public  affairs,  civil  affairs,  and  physical  or  computer  network  attack."^  This  list  is  representative, 
but  by  no  means  exhaustive  as  depieted  by  the  “Other”  eategory  in  Figure  1. 
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INFORMATION  OPERATIONS:  CAPABILITIES 
AND  RELATED  ACTIVITIES 


Figure  1:  Information  Operation:  Capabilities  and  Related  Activities^ 


John  Petersen  posits  two  generations  of  information  warfare.  The  first  presumes  a 
continuing  and  not-unreasonable  desire  on  the  part  of  combatants  to  destroy  targets  either  in 
actuality  or  in  effect:  “the  military  is  looking  at  future  warfare  with  a  perspective  that  presumes 
that  the  extraordinary  characteristics  of  information  technology  will  essentially  be  used  to  break 
things  better  and  therefore  kill  people  more  efficiently.  ...  [FJamiliar  military  objectives  are 
targeted  using  new  technology.”^  Greenberg,  Goodman  and  Soo  Hoo  compile  an  apt  list  of 
possible  scenarios  in  this  first  generation  shown  in  Table  1. 
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Table  1  Examples  of  Potential  Information  Warfare  Attacks’ 

“Trap  door”  hidden  in  code  controlling  switching  centers  of  the  Public  Switched 
(Telephone)  Network  causing  portions  of  it  to  fail  on  command 

Mass  dialing  attack  by  personal  computers  overwhelms  local  phone  system 

“Logic  bomb”  or  other  intrusion  into  rail  computer  systems  causes  trains  to  be 
misrouted  and  crash 

Enemy  radio  and  television  network  taken  over  electronically,  and  then  used  to 
broadcast  propaganda  or  other  information.  “Video  morphing”  could  make  the 
new  broadcasts  indistinguishable  from  enemy's  own  usual  broadcasts 

Remotely  alter  formulae  for  medication  at  pharmaceutical  manufacturers,  or 
personal  medical  information,  such  as  blood  type,  in  medical  databases 

Concerted  e-mail  attack  overwhelms  or  paralyzes  a  significant  network 

Divert  funds  from  bank  computers,  or  corrupt  data  in  bank  databases,  causing 
disruption  or  panic  as  banks  need  to  shut  down  to  address  their  problems 

Steal  and  disclose  confidential  personal,  medical,  or  financial  information  to 
blackmail,  extort  and/or  cause  widespread  social  disruption  or  embarrassment 

“Computer  worm”  or  “virus”  damages  data  and  disrupts  systems 

“Infoblockade”  permits  little  or  no  electronic  information  to  enter/leave  a  target 
nation  {i.e.,  the  servers  and  gateways  known  to  be  primary  portals  for  target) 

Nation's  command  and  control  infrastructure  disrupted  with  individual  military 
units  unable  to  communicate  either  with  each  other  or  with  central  command 

Stock  or  commodity  exchanges,  electric  power  grids,  municipal  traffic  control 
systems,  and  air  traffic  control  systems  manipulated  or  disrupted  with 
accompanying  disruption,  physical  destruction,  or  loss  of  life 


The  examples  from  Table  1  are  far  from  hypothetical.  Many  already  exist  in  one  form  or 
another  with  practical — often  financial — consequences.  The  presence  of  row  nine's  computer 
viruses  is  all  but  self-evident.  Anti-virus  vendors  currently  catalogue  more  than  53,000  different 
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viruses.  Meanwhile,  the  ‘trap  doors’  from  the  first  row  of  Table  1  and  the  ‘logic  bombs’  from 
row  three  can  reside  within  either  hardware  or  software.  In  hardware,  they  typically  reside  on  the 
integrated  circuits  more  commonly  known  as  silicon  chips.  Information  war  theorists  codify  the 
practice  as  follows:  “The  modification,  alteration,  design,  or  use  of  integrated  circuits  for  pur 
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poses  other  than  those  originally  intended  by  the  designers  is  called  ‘chipping.’  And  chipping 
provides  the  Information  Warrior  with  a  bevy  of  opportunities  to  wage  war.”^ 

At  one  end  of  the  chipping  spectrum  is  rampant  fraud  against  cellular  phone  systems. 
Wireless  telephones  routinely  broadcast  their  chip's  serial  number  with  every  attempted  call. 
Interceptors  surreptitiously  capture  that  information,  then  use  it  to  program  fraudulent  chips.  The 
billing  system  charges  the  calls  made  with  the  phony  phone  chips  to  the  unsuspecting  owners  of 
the  originals.  The  annual  cost  of  this  fraud  to  the  telecommunications  industry  and  its  consumers: 
$300  million  to  $350  million. 

Chipping's  other  extreme  uses  “a  circuit  that  electromagnetically  broadcasts  a  distinctive 
signal  or  pattern  as  a  tracking  device  . . .  [or]  a  useful  tool  for  gathering  information  in  a  clandes¬ 
tine  manner.”^  ^  Vendors  such  as  Codex  Systems  openly  advertise  sales  of  such  devices  to  mili- 
tary  and  intelligence  agencies.  After  all,  “replacing  or  adding  a  chip  to  a  computer  or  printer  is 
not  too  difficult  for  a  repairman  or  computer  dealer.”  Beyond  simple  surveillance,  there  are 
also  “information  warfare  targets  designed  to  enhance  an  attacker's  relative  military  position:”'"^ 

“The  arms  industry  is  an  ideal  market  for  government-sponsored  chipping.  ... 

[T]he  electronic  goodies  inside  the  weapon  system  have  been  chipped;  they  have 
been  modified  perhaps  to  fail  in  three  months  [^/c]  time,  or  to  shoot  off  course  by 
three  degrees,  or  to  blow  themselves  up  after  two  shots.  Or  maybe  they  have  a 
radio  beacon  installed  in  them  that  identifies  their  exact  location  to  overhead 
satellites.  ...  From  the  Information  Warrior's  viewpoint,  chipping  takes  advantage 
of  unexploited  vulnerabilities  that  exist  in  virtually  every  electronic  system.”*^ 

A  final  example  from  row  seven  of  Table  1  points  to  the  upheaval  associated  with  loss  of 

financial  data.  Such  economic  information  warfare  has  non-trivial  impacts. 

“[It]  involves  the  destruction  of  the  marketplace,  by  preventing  buyers  and  sellers 
from  communicating  with  each  other  or  erasing  records  of  transactions.  ...  A 
series  of  [information  warfare]  attacks  on  a  country's  major  banks,  draining  them 
of  their  assets,  would  cause  a  major  panic  ...,  a  serious  degradation  of  that 
country's  financial  position  relative  to  the  rest  of  the  world  and  cause  long-term 
damage  to  the  country's  well-being. 
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Extreme  cases  of  financial  disruption  can  also  foment  political  upheaval  as  occurred  in 

Albania  during  1997.  In  that  period  a  collection  of  ‘get-rich-quick’  pyramid  schemes  which  had 

supplanted  the  country's  formal  and  informal  credit  markets  failed  catastrophically  wiping  out 
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almost  half  the  nation's  reported  GDP  and  much  of  the  personal  savings  of  ordinary  Albanians. 
The  resultant  rioting  brought  about  the  collapse  of  the  government  in  Tirana  and  ushered  in  a 
period  of  anarchy  and  civil  war  which  claimed  some  2,000  lives.  Such  mayhem,  death  and 
destruction  caused  just  by  phony  numbers  is  hardly  inconsequential. 

However,  Petersen  is  not  content  with  these  more  tangible,  first-generation  effects.  For  him, 
“warfare  is  not  about  equipment  or  armies.  It  is  about  influencing  peoples  [5/c]  minds.  Warfare  is 
about  achieving  behavior  change....  (emphasis  in  original)”  In  describing  his  second 
generation,  Petersen  draws  upon  the  philosophies  of  the  ancient  Chinese  strategist.  Sun  Tzu:  “To 
subdue  the  enemy  without  fighting  is  the  acme  of  skill.  Thus,  what  is  of  supreme  importance  in 
war  is  to  attack  the  enemy’s  strategy.”  Therefore,  second-generation  information  warfare  is  less 
about  the  ‘warfare’  and  more  about  the  ‘information.’  Its  antecedent  likewise  moves  from  the 

battlefield  to  Madison  Avenue:  “What  will  the  second-generation  [^zc]  of  Infowar  look  like? 

22 

Well,  it  probably  looks  much  like  advertising....” 

Advertising?  While  advertising  hardly  seems  to  be  the  province  of  the  military 
commander,  re-examination  of  joint  doctrine  shows  that  “human  decision  making  processes  are 
the  ultimate  target  for  offensive  information  operations. Information  operators  do,  in  fact,  seek 
actively  to  manage  the  enemy’s  perceptions.  In  like  manner,  advertisers  work  to  subvert  human 
decision-making  processes  and  thereby  to  accomplish  their  commercial  objectives — i.e., 
convincing  consumers  to  surrender  money  for  products  or  services.  The  decision-making 
processes  are  substantially  the  same  whether  the  objective  is  increased  sales  or  to  help  “joint 
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force  commanders  influence  the  outcome  of  campaigns  and  major  operations.”  The  two  sets  of 
processes  converge  and  can  be  influenced  in  similar  ways.  In  the  end  “is  a  world  where  ideas, 
messages,  and  admonitions  are  focused  on  individuals  and  groups  who  never  figure  out  that  they 

have  been  soldiers  in  a  battle.  The  most  successful  campaigns,  by  definition,  are  never  public. 

28 

The  adversary  never  knows  that  he  or  she  was  in  a  skirmish.” 

It  follows  naturally  that  unwitting  adversaries  in  perfectly  covert  campaigns  will  never  know 
that  they  are  the  victims  of  information  war  crimes.  Moreover,  neither  will  any  other  member 
of  the  world  community.  Thus,  one  expects  the  intersections  of  information  warfare  with  the  law 
of  armed  conflict  which  are  most  likely  to  be  called  criminal  to  come  from  the  first  generation. 
That  does  not,  however,  imply  that  the  second  generation  will  have  evolved  beyond  any  such 
legal  considerations;  quite  the  opposite,  in  fact.  Victims’  ignorance  notwithstanding,  “violations 
of  the  law  of  armed  conflict  subjects  [^/c]  individuals  to  criminal  sanctions  under  national  laws 
(as  exist  in  the  U.S.)  and  to  international  judgment....”  How  then,  might  the  principles  of  the 
law  of  armed  conflict  define  an  information  war  crime? 
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Chapter  4 


The  Law  of  Armed  Conflict  meets  Information  Warfare 

Information  warfare,  in  much  larger  construct,  merges  the  miracles  of  modern 
information  technology  to  an  information  strategy  of  victory  without  violence. 

Here  information  is  a  weapon  and  target  onto  itself:  not  just  a  magnifier  for 
physical  forces  engaged  in  traditional,  legal  wars.  The  targets  are  the  opponents 
[sic]  political,  social  and  economic  infrastructures — thus  raising  legal,  ethical 
and  moral  issues  that  have  not  been  confronted  before,  (emphases  in  original) 

— ^Alan  D.  Campen,  Colonel  (ret),  USAF* 

Over  time  the  law  of  armed  eonfliet  and  its  defining  principles  have  been  adapted,  amended 
and  applied  as  necessary  to  new  situations  and  new  technologies.  As  has  been  previously  stated, 
one  goal  of  the  Hague  Convention  in  1899  was  to  prohibit,  if  only  temporarily,  “the  launching  of 
projectiles  and  explosives  from  balloons,  or  by  other  new  methods  of  similar  nature.”  In  that 
case  the  international  community  took  positive  action  collectively  to  evaluate  and  codify  the 
legitimacy  or  illegitimacy  of  weapon  types  and  weapon  delivery  mechanisms.  While  not 
impossible,  that  option  is  less  likely  to  occur  with  information  warfare.  Instead,  judge  advocates 
currently  expect  the  law  of  armed  conflict  to  “be  made  applicable  to  new  information 
technologies  by  analogizing  them  to  their  closest  pre -Information  Age  antecedents.”"^  The 
analogies  would  be  drawn  from  the  practical  effects  of  the  weapons  or  technologies.^ 

One  rather  large  effect  such  information  warfare  weaponry  could  have  is  the  effective 
declaration  of  war.  However,  scholars  and  diplomats  alike  remain  conflicted  over  whether  any 
peacetime  uses  of  information  operations  constitute  an  act  or  war  and  if  so,  which  ones:  “War,  as 
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we  have  traditionally  understood  it,  inherently  includes  armed  forces,  force  and  violence.”^ 
These  are  the  manifestations  which  the  U.N.  Charter  expressly  forbids.  Its  preamble  plainly 
states  that  “armed  force  shall  not  be  used,  save  in  the  common  interest.”  Chapter  I  goes  on  to 
proscribe  the  use  of  force. ^  What  the  Charter  does  not  express,  however,  is  a  definition  of  what 
exactly  constitutes  such  a  “use  of  force.”  Twice  in  fact,  in  1945  and  again  in  1970,  the  U.N. 
General  Assembly  and  its  precursor  body  have  pointedly  opted  not  to  place  bounds  on  this 

g 

question,  instead  deferring  the  issue  to  case-by-case  analysis  and  thus  more  flexible 
determinations  by  the  U.N.  Security  Council. 

In  this  light  the  question  of  reprisals  and  information  warfare  gains  special  significance.^ 
However,  for  the  purposes  of  this  discussion  on  information  war  crimes,  the  simplifying 
assumption  will  be  that  a  bellicose  state  of  affairs  already  exists,  i.e.,  that  both  the  information 
warfare  attacker  and  the  target  already  consider  themselves  to  be  in  armed  conflict.  As  such, 
the  four  principles  of  the  law  of  armed  conflict  provide  guidance  equally  to  the  physical  and 
informational  attacker  about  the  legality  of  their  actions. 

Working  back  through  those  four  principles,  recall  that  proportionality  requires  the  military 
commander  to  estimate  the  impact  of  his  attacks  in  order  to  limit  their  effect  on  the  civilian 
population.  However,  the  information  warrior  cannot  know  a  priori  precisely  where  a  computer 
virus  or  worm  might  spread  once  released.  That  would  require  precise  knowledge  of  the  entire 
connectivity  of  the  target  system  which  even  the  owners  themselves  may  not  have;  hence  the 
vulnerability.  Similarly,  should  the  actual  impact  of  a  software-based  attack  against  military  air 
traffic  control  also  disable  civilian  systems,  strand  passenger  aircraft  in  instrument 
meteorological  conditions  and  lead  to  civilian  loss  of  life,  the  information  warrior  may  face  a  war 
crimes  tribunal  on  charges  the  attack  was  not  proportional  or  was  ‘indiscriminate’  under  Article 
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51  of  the  1977  Geneva  Protoeols.'^  Although  “direeted  at  a  speeific  military  objeetive,”  the 

12 

attack  did  “employ  a  method  or  means  of  combat  the  effects  of  which  cannot  be  limited.” 

In  such  disproportionate  cases,  the  commander  really  has  little  defense  except  to  say  wanly: 
“1  didn’t  mean  to  do  that.”  To  that  end,  war  crimes  jurisprudence  contains  the  so-called 
“Rendulic  Rule”  which  judges  commanders’  decisions  only  in  light  of  knowledge  that  was 
available  to  them  at  the  time.'"^  One  legal  opinion,  then,  suggests  that  as  a  precaution,  the 
information  warfare  commander  delineate  and  record  his  or  her  military  objectives  and  intentions 
before  an  attack  to  make  this  legal  defense  available. 

With  or  without  precautions,  the  law  of  armed  conflict  does  allow  for  collateral  damage  as  a 
practical  reality  of  war.  However,  it  also  bounds  the  permissible  amount  of  such  damage. 
Through  the  principle  of  proportionality,  the  international  community  reserves  the  right  to  hold 
attackers  who  exceed  those  limits  responsible  as  war  criminals  whether  their  means  were 
physical  or  cyber. 

The  next  principle,  military  necessity,  presents  a  less  thorny  issue.  Simply  stated,  the 
intended  target  must  have  military  value  and  receive  only  enough  force  to  ensure  its 
destruction.^^  From  a  targeting  standpoint,  the  information  warrior — like  any  other  military 
commander — can  easily  avoid  war  crimes  charges  if  he  or  she  refrains  from  choosing  purely 
civilian  objectives:  “Stock  exchanges,  banking  systems,  universities,  and  similar  civilian 
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infrastructures  may  not  be  attacked  simply  because  a  belligerent  has  the  ability  to  do  so.” 

Interestingly  though,  there  is  movement  afoot  to  loosen  this  prohibition:  “The  methodology 
of  warfare  may  change  during  the  Information  Age  that  appears  to  be  upon  us.  ...  The  result  may 
be  far  less  bloodletting  in  human  casualties,  although  the  result  of  an  Information  War  may  be 
just  as  catastrophic  for  the  losers.”  Strict  interpretation  of  military  necessity  permits  attacks 
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against  the  persons,  but  not  the  personal  property,  of  enemy  leadership/^  Thus,  the  legal 

roadblocks  to  an  alleged  plan  during  Operation  ALLIED  FORCE  to  attack  Milosevic's  personal 

finances:  “absent  a  showing,  for  example,  that  monies  are  being  used  to  directly  support  a 

military  effort,  [law  of  armed  conflict]  would  not  permit  raiding  Milosevic's  personal 

accounts.”  However,  these  contrarian  information  war  theorists  argue  instead  the  military 

necessity  of  attacking  the  very  fabric  of  bellicose  societies  and  imperiling  the  way  of  life  which 

sustains  them:  “This  proposal  openly  acknowledges  an  intent  to  inflict  hardship  upon  the  ... 

populace  who  must  be  held  responsible  for  the  deeds  of  their  military  forces.”  Of  course,  lower 

standards  will  expose  newly  legitimate  targets  of  opportunity  in  technologically  advanced  states: 

“The  concept  of  military  objective  will  remain  beleaguered  as  civilian  activities 
are  further  militarized,  and  military  activities  are  increasingly  civilianized  .... 

How  is  one  to  distinguish,  as  an  example,  a  computer  chip  manufacturer  that  sells 
its  chips  only  to  civilian  end-users  from  one  that  has  a  number  of  military 
contracts?  ...  If  military  officers  use  Microsoft  Word®  as  their  word  processing 
software  of  choice,  for  example,  does  a  Microsoft  plant  become  a  valid  target?”^^ 

Military  necessity  also  presents  a  special  case  for  a  lone  superpower:  “For  the  United  States, 
therefore,  military  necessity  often  cannot  mean  that  an  act  is  strictly  necessary.”^"^  This  is  because 
this  principle  inveighs  against  overkilling  a  target.  To  some  extent  there  exists  an  overlap  with 
proportionality  on  this  since  the  overkill  from  using  excessive  force  is  necessarily 
disproportionate.  For  the  information  warrior,  especially  while  ‘information  weaponry’  is  new 
and  relatively  untested,  the  possibility  of  legitimate  overkill  remains.  If,  for  example,  the 
commander  does  not  know  the  full  extent  of  the  enemy's  information  defenses,  he  or  she  could 
reasonably  opt  to  increase  the  ‘cyber  ordnance’  assigned  to  a  target  to  produce  the  desired 
results.  The  problem  is  that  “[information  warfare]  weapons  are  so  new  and  unproved  in  battle 
that  commanders  cannot  know  with  any  confidence  how  much  is  enough.”  Too  much 
additional  ‘ordnance’  could  run  afoul  of  war  crimes  law  under  the  principle  of  proportionality.  In 
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this  case,  however,  even  legal  arguments  bend  to  practical  realities:  the  “law  of  armed  conflict 
does  not  require  commanders  to  dilute  attacks  to  the  point  where  mission  objectives  may  not  be 
achieved  or  their  own  forees  are  jeopardized,  and  thus  the  eommander’s  actions  seem 
appropriate.”^^ 

Third  is  the  law  of  armed  eonflict’s  humanity  principle.  Like  proportionality,  humanity 
requires  the  military  commander  to  eonsider  the  possibility  an  attack  may  cause  unneeessary 
suffering  and/or  superfluous  injury,  particularly  on  the  civilian  populace.  The  issues  for  the 
information  warrior  lie  in  the  ubiquitous  nature  of  computer  and  information  systems. 
Intereonnectedness  is  a  hallmark  of  the  Information  Age.  As  sueh,  military  targets  like  the 
aforementioned  air  traffie  control  system  or  an  eleetrical  power  generation  system  are  more 
likely  to  be  elosely  linked  with  civilian  systems  in  myriad  ways.  During  Operation  DESERT 
STORM  the  Iraqi  government  attempted  to  turn  the  tables  on  coalition  forces  using  this  rubrie. 
After  conventional  bombing  took  out  Baghdad’s  electrical  system,  the  Iraqis  alleged  that  the 
attack  was  attempted  genoeide  and,  therefore,  both  inhumane  and  disproportionate.  The  Iraqi 
capitoTs  waste  treatment  systems  operated  using  eleetrical  pumping  stations.  Without  electricity, 
the  eity  sewers  backed  up  threatening  epidemic  disease  and,  thereby,  genoeide.  The 
intereonnectedness  in  this  example  is  physical,  but  the  coneerns  for  the  information  warrior  are 
the  same:  “The  day  is  bound  to  come  when  an  information  warfare  attack  by  the  United  States 
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against  military  targets  results  in  civilian  casualties.” 

On  the  other  hand,  the  prineiple  of  humanity  eould  also  present  an  argument  for  the 
expanded  use  of  information  weapon  systems  and  lessen  the  information  warrior’s  exposure  to 
war  erime  charges.  Humanity  might  “favor  an  [information  warfare]  operation,  for  example, 
when  the  only  military  alternative  is  dropping  a  large  explosive  on  or  near  the  same  target.”  Of 
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course,  this  presumes  the  target’s  proximity  to  populated  areas.  Nevertheless,  “the  principle  of 
humanity  appears  to  argue  in  favor  of  applying  information  operations  if  the  alternatives  threaten 
greater  physical  destruction  and  loss  of  life.”  After  all,  “hurting  a  civilian's  pocketbook  is  more 
ethical  than  bombing  him.”^"^ 

Finally,  there  is  chivalry.  More  than  the  other  three,  this  principle  harks  baek  to  the 
previously  discussed  theories  on  first-  and  second-generation  information  warfare.  Reeall 
Petersen’s  comparison  of  second-generation  information  warfare  to  advertising.  Application  of 
this  theory  questions  the  ehivalrous  nature  of  a  skirmish  which  the  adversary  never  knows  even 
happened.  After  all,  even  Madison  Avenue  must  abide  by  truth-in-advertising  laws  requiring 
advertisers  1)  to  be  truthful  and  non-deceptive;  2)  to  have  evidenee  to  baek  up  their  claims;  and 
3)  not  to  be  unfair.  In  any  event  failure  to  meet  these  uniquely  commereial  criteria  does  not 
sink  to  the  level  of  perfidy  whieh  the  law  of  armed  conflict  expressly  forbids.  Rather,  the  better 
analogy  might  be  to  a  completely  permissible  ruse  of  war  the  intent  of  whieh  is  to  mislead  the 
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enemy  and  to  induce  speeific  actions  on  his  or  her  part.  These  actions  may  not  be  in  the 
enemy’s  best  interest,  but  neither  are  they  perfidious  sinee  they  do  not  seek  to  betray  the  enemy’s 
eonfidence  given  under  a  proteeted  symbol.  The  1977  Geneva  Protocols  define  ruses  of  war  to 
include  “camouflage,  decoys,  mock  operations  and  misinformation.”  Plainly,  misinformation  is 
the  watchword  here  and  very  apt  for  the  information  warrior’s  purposes. 

This  is  not  to  suggest,  however,  that  information  warfare  is  immune  to  perfidy.  A 
eounterexample  might  be  a  Trojan  horse  or  other  malicious  code  that  is  forwarded  to  the  enemy 
cleverly  disguised  as  e-mail  from  the  Red  Cross/Red  Crescent  Soeiety  or,  for  that  matter,  as  an 
executable  software  patch  or  upgrade  from  a  reputable  software  manufaeturer  and/or  eomputer 
seeurity  firm,  e.g.,  anti-virus  updates.  Nevertheless,  “chivalry  may  not  weigh  heavily  in  the 
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decision  over  whether  to  undertake  [information  warfare],  if  only  because  the  penalty  for  under¬ 
estimating  chivalry  is  not  likely  to  be  applied  unless  the  perpetrator  loses  the  war  and  the 
evidence  and  forum  exist  to  convict  her  of  a  war  crime. 

Mitnick  meets  Milosevic 

So  then,  when,  where  and  how  do  Messrs.  Mitnick  and  Milosevic  meet?  Interestingly,  since 
his  release  from  federal  prison  in  January  2000,  the  former  is  working  hard  at  reformation  and 
appears  to  be  taking  positive  steps  to  leave  his  information  crimes  behind.  Fewer  than  six  weeks 
after  becoming  an  ex-convict,  he  was  freely  giving  testimony  before  the  United  States  Senate  to 
advise  that  legislative  body  as  it  sought  to  understand  and  to  address  the  issues  of  information 
security:  “The  United  States  was  my  adversary  in  years  of  litigation....  Despite  that,  I  am  ready, 
willing,  and  able  to  assist,  and  that  is  why  I  am  here  today. 

On  the  other  hand,  Milosevic,  unlike  Mitnick,  has  not  seemed  content  to  remain  on  just  one 

side  of  the  divide  between  war  crimes  and  information  crimes.  While  under  attack  during 

Operation  ALLIED  FORCE,"^^  Milosevic’s  government  actively  engaged  in  computer  network 

attacks  against  NATO  forces,  albeit  with  minimal  success: 

“There  was  a  good  deal  of  publicity  given  to  the  activities  of  Serbian  hackers 
who,  with  a  degree  of  government  sponsorship,  sought  to  disrupt  NATO 
information  systems.  They  had  limited  success  against  two  NATO  websites  but 
failed  to  systematically  disrupt  NATO  information  activities  or  to  gain  access  to 
closed  defence  systems.  Nonetheless,  Serbian  use  of  CNA  [computer  network 
attack],  however  tentative,  is  a  reminder  of  the  potential  of  this  threat. 

As  of  February  2001,  Milosevic  has  yet  to  see  the  inside  of  a  jail  cell.  Indictments  from  the 
International  Criminal  Tribunal  for  the  Former  Yugoslavia  notwithstanding,  the  deposed  head  of 
state  remains  at  large.  Events  are  still  playing  themselves  out,  but  U.S.  Secretary  of  State  Colin 
Powell  and  members  of  the  international  financial  community  have  given  Serbia  “until  March  3 1 
[2001]  to  co-operate  with  the  war  crimes  tribunal  in  The  Hague. 
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Conclusion 


Examination  clearly  shows  areas  where  the  law  of  armed  confliet  and  information  warfare 
intersect.  That  body  of  law  sets  broad  bounds  for  information  war  erimes  just  as  it  does  for  other 
war  crimes.  Meanwhile,  judge  advoeates  and  information  war  theorists  seek  to  narrow  those 
boundaries  determining,  for  example,  what  specifie  aspects  of  the  ever-more-eonjoined  military 
and  civilian  infrastructures  will  be  legitimate  information  warfare  targets. 

Recent  interpretations  of  the  law  of  armed  eonfliet  have  not  redefined  war  crimes  to  fit  the 
Information  Age.  Instead,  since  the  Geneva  and  Hague  Conventions — and  more  specifically,  the 
Martens  Clause  thereof — judge  crimes  by  their  effects  and  not  their  methods,  the  question  of 
information  war  erimes  has  focused  on  new  effeets  unique  to  the  Information  Age.  Military 
actions  by  any  means  which  cause  effeets  previously  proseribed  by  one  or  more  of  the  law  of 
armed  conflict’s  four  defining  principles  are  and  remain  criminal.  Each  of  those  principles — 
chivalry,  humanity,  military  necessity  and  proportionality — has  carry-overs  from  traditional 
warfare  to  information  warfare.  Additionally,  the  entire  quartet  projects  into  the  2E*  century. 
These  projeetions  serve  as  lighthouses  to  warn  information  operations  commanders  and  planners 
away  from  the  shoals  of  potentially  unlawful  behavior.  The  information  warrior  may  not  be 
physically  positioned  to  commit  traditional  ‘crimes  against  humanity’  as  defined  in  the  London 
Charter — e.g.,  murder,  torture,  rape,  enslavement,  plunder,  the  razing  of  villages,  ete. 
Nevertheless,  the  information  warrior's  attaeks  can  impact  the  civilian  population.  Should  those 
attacks  be  disproportionate,  inhumane  or  found  militarily  unneeessary,  the  information  warrior 
cannot  expect  immunity  from  war  crimes  tribunals.  All  may  be  fair  in  love,  but  not  in  war.  The 
1907  Hague  Protocol  IV  and  the  Martens  Clause  see  to  that. 
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